Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It seems many people like using Process Monitor to see what changes are being made to the registry during a process. So I downloaded it.

I want to see what changes are made in the registry by some config changes I'm making on my computer so I can write them into a vbs script to do them easily. Can someone tell me how to drive Process Monitor to capture the info? In the Help I don't see how to do it.

I'm using Windows 7 home Premium 64 bit.

share|improve this question
    
What OS? Also, it does not run in a browser. –  KCotreau Aug 2 '11 at 1:06
    
If it matters I should've been more clear and said that the right pane of the Help is where the message comes up. The left side pane is the navigation with the Contents, Index, and Search tabs. –  CChriss Aug 2 '11 at 2:30
    
Yup that makes all the difference. My answer does not apply anymore. [delete] –  James T Aug 2 '11 at 2:42
    
I added a new answer for ya. I misunderstood the question at first. Hopefully it's helpful now. –  James T Aug 2 '11 at 2:48
    
Did you run it from within the downloaded ZIP file, or did you extract all the files to a directory, and then run it? –  KCotreau Aug 2 '11 at 2:49

2 Answers 2

up vote 5 down vote accepted

In the directory where procmon.exe resides, there should also be a file called procmon.chm (if you extracted them to the same place). Right click on procmon.chm and properties. Then click "Unblock".

You are experiencing the issue described here.

Edit:

Now to address the actual question.

  1. Open up process monitor.

  2. The filters will probably show up. Press reset to reset the filters and click OK. Otherwise you can open them with ctrl-L and press reset.

  3. There is an icon on the top toolbar that looks like cross hairs with circles (8th from the left). Drag that to the (config) window who's activity you want to watch (if you want to filter on that process). You might otherwise clutter up your readings with activities from other processes.

  4. Clear the activity log (ctrl-x).

  5. Now make your config changes and watch the registry keys fly by.

share|improve this answer
    
+1 Very good find. –  KCotreau Aug 2 '11 at 2:54
    
+1. Now I guess back to my original question. –  CChriss Aug 2 '11 at 2:56
    
@CChriss Oh Right... forgot there was more to the question. I updated my answer again. –  James T Aug 2 '11 at 3:10
    
Works great. Thank you again for all your help. –  CChriss Aug 5 '11 at 4:02

CHM files (compiled html) are "blocked" by default as a security measure in Windows 7. Find the help file that belongs to Process Monitor, view it's properties, and click the unblock button.

As for Process Monitor itself, it collects a lot of data, so you'll want to try and filter what you're looking for. You can do this a couple of ways. You can just capture all of the data to a capture file, then open it to filter the data viewed - this still preserves all of your data. You can also configure your filters to capture only the data you want to see, and save that - less resource hungry, but you lose data that you may want to see later.

If you only downloaded Process Monitor, I suggest taking a look at the rest of tools available in the Sysinternals Suite. They're great for troubleshooting and better understanding how Windows works.

share|improve this answer
    
+1. Now that I actually can look into the Help I didn't see any instructions on how to do what I need Proc Mon for. –  CChriss Aug 2 '11 at 3:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.